WizOct 19, 2026Added Oct 19
Wiz (Oct 19) says AI-driven attacks are rising; in several intrusions an AI agent ran the entire operation: exploiting an exposed Kafka UI, stealing Kubernetes service account tokens, minting GCP credentials, abusing AWS SSM, creating an IdP admin, and weaponizing CI/CD and GitOps. The same source IP scanned 600+ other Wiz customer environments. Wiz's first recommendation: unify logs across all platforms.
Source · wiz.io
SplunkOct 13, 2026Added Oct 19
Splunk (Oct 13) made the Cisco Deep Time Series Model (CDTSM) generally available in Splunk AI Toolkit and previewed Log Reasoning and Graph Reasoning foundation models; customer Mitiga reported about 95% fewer false-positive alerts. Separately, Splunk will disclose fixes on Oct 21 for Enterprise and Universal Forwarder 10.4.4, 10.2.8, 10.0.11, and 9.4.16 and SOAR 8.7.0 (SVD-2026-1006).
Source · splunk.com
MicrosoftOct 19, 2026Added Oct 20
On Oct 19 Microsoft extended Project Perception to govern internal AI agents: discovery of 35 more local agent types (60 total, including Claude Code, OpenAI Codex, GitHub Copilot), new Entra Agent ID identity types, Dynamic Permissions (task-scoped, time-bound), Dynamic Agent Risk, Dynamic Conditional Access for agents with graduated containment, and Guardian Agents with Playbooks. Project Perception and Agent 365 share a unified registry.
Source · microsoft.com
WizOct 19, 2026Added Oct 20
Wiz (Oct 19) described a pipeline that analyzes each new npm package version at publication using static analysis, an AI classifier, and sandboxed runtime analysis with the Wiz Sensor, then publishes IOCs to Wiz Defend and code and cloud scanning before a CVE exists. Wiz says notable supply chain attacks rose from about 10% of significant incidents in H2 2025 to 25% in H1 2026.
Source · wiz.io
DatadogOct 19, 2026Added Oct 20
CNBC reports Bernstein upgraded Datadog to Outperform on Oct 19 and raised its price target to $350 from $237, citing alternative data showing enterprise token consumption at the largest AI labs grew at least 50% quarter over quarter; Bernstein flagged open-source and in-house replacement as the main risk. Shares were up about 82% year to date. Datadog reports Q3 results Nov 4.
Source · cnbc.com
SplunkOct 19, 2026Added Oct 20
Splunk (Oct 19) said Edge Processor, Ingest Processor, and Splunk AI Assistant achieved FedRAMP High for Splunk Cloud Platform customers in AWS GovCloud (US), and SPL2 is now available across the platform. Separately, Splunk will publish advisories on Oct 21 for fixes in Splunk Enterprise and Universal Forwarder 10.4.4, 10.2.8, 10.0.11, 9.4.16 and SOAR 8.7.0.
Source · splunk.com
SentinelOneOct 21, 2026Added Oct 21
On Oct 21 at OneCon, SentinelOne unveiled Singularity ASOC (Autonomous SOC). It bundles Purple Agentic Investigation, Hyperautomation, AI Data Pipelines (50+ connectors, including Palo Alto Prisma, Microsoft Defender XDR, and Wiz; OpenTelemetry and generic API collection listed as coming), AI SIEM with incident and case management, and threat-intel/IOC management. It is paid for with Singularity Credits, with analyst-set consumption guardrails. SentinelOne says Purple Agentic Investigation has completed 400,000+ investigations and saved about 332,000 analyst hours. (SentinelOne's own press-release URL returned 404 when checked on Oct 21; source is WebProNews coverage.)
Source · webpronews.com
CrowdStrikeOct 20, 2026Added Oct 21
CrowdStrike says (Oct 20) its incident response practice is now assured at the Enhanced Level of the UK NCSC Cyber Incident Response (CIR) scheme, the highest IR assurance the UK government offers, building on the Standard Level assurance announced earlier this year.
Source · crowdstrike.com
WizOct 20, 2026Added Oct 21
Wiz CIRT (Oct 20) describes GCP-focused intrusions in which Google Search ads for terms like 'google cloud' led to fake login pages that captured credentials and MFA codes. Attackers then enabled the Gemini API in low-usage projects, created service accounts with Gemini API keys and high-privilege roles such as roles/ml.admin, and linked attacker-controlled GCP projects to the victim's billing account. Victims paid for hundreds of thousands of dollars in AI API charges without seeing the prompts or outputs.
Source · wiz.io
GoogleOct 19, 2026Added Oct 21
Google's weekly 'What's New in Google SecOps' (Oct 19, covering Oct 12-18) says the deadline for migrating SOAR APIs to the Chronicle API moved from Nov 30, 2026 to Mar 31, 2027. Google also published parity docs for moving MSSPs off the legacy Backstory Partner API, Applied Threat Intelligence curated rules now use the GTI_IOC feed, and Google TI added a macOS Mirage Sandbox. The roundup's top item was Gemini 4 Argon's release.
Source · security.googlecloudcommunity.com
CrowdStrikeOct 21, 2026Added Oct 22
CrowdStrike is integrating Falcon Guardian (AI Detection and Response) with the NVIDIA OpenShell runtime and plans to integrate with NVIDIA Sentry on BlueField-4 for in-silicon enforcement. Autodesk is quoted. Separately, CrowdStrike published PHP2Shell coverage: post-exploitation detection, Exposure Management checks, and a Next-Gen SIEM correlation template.
Source · crowdstrike.com
SentinelOneOct 21, 2026Added Oct 22
At OneCon on Oct 21, SentinelOne unveiled Singularity ADR, which discovers AI agents, enforces what they can do, monitors their behavior, and stops malicious or unintended activity in real time. It's built on the Singularity Platform and is in early access. It shipped alongside the Singularity ASOC suite.
Source · sentinelone.com
MicrosoftOct 20, 2026Added Oct 22
Microsoft made cross-tenant delegated administration in Defender generally available, built on Entra Tenant Governance. It extends delegated access to Sentinel resources, with granular Defender unified RBAC for non-CSP MSSPs and multi-tenant organizations. BlueVoyant and CyberCX are quoted.
Source · techcommunity.microsoft.com
WizOct 21, 2026Added Oct 22
Wiz says every PHP version back to 5.4 is affected by at least one of the PHP2Shell bugs and showed pre-auth RCE on WordPress, Drupal, and Joomla. It used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to find them. Wiz Defend and the Wiz Sensor detect exploitation, with an automatic response policy on Sensor version 1.0.12768.
Source · wiz.io
SplunkOct 21, 2026Added Oct 22
SVD-2026-1007 (Oct 21) fixes multiple CVEs in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16, including RCE through Splunk Web Manager XML, authorization bypass, and SPL injection in Secure Gateway. SecurityWeek counts 16 Enterprise CVEs (including critical CVE-2026-76299 and CVE-2026-76302) and 15 in SOAR 8.7.0 (including critical CVE-2026-76531 and CVE-2026-76407). The Universal Forwarder was dropped from the batch.
Source · advisory.splunk.com
CrowdStrikeOct 21, 2026Added Oct 23
CrowdStrike's Oct 21 Counter Adversary Operations report describes four previously unreported actors using AI agent harnesses; one ran a Claude Code supervisor/executor setup derived from PentestGPT against at least 15 Argentine healthcare organizations. Per Cybersecurity Dive, the report counts three times as many agentic intrusions in H2 2026 as H1 and says token budgets, not engineering, are the main barrier to scale. CrowdStrike assesses agentic intrusions will almost certainly increase. Defender guidance is in the gated full report.
Source · crowdstrike.com
SentinelOneOct 21, 2026Added Oct 23
SentinelOne announced on Oct 21 that Prompt Security is now part of Lenovo's ThinkShield portfolio, discovering sanctioned and shadow AI use, stopping sensitive data from reaching unauthorized AI apps, and enforcing policy in real time, building on SentinelOne EDR already in ThinkShield.
Source · sentinelone.com
MicrosoftOct 20, 2026Added Oct 23
Microsoft announced on Oct 20 a public preview of Unified Data Management in the Defender portal (Setup & configuration > Data & connectors), showing ingestion volume split between the Analytics and Data Lake tiers, connectors needing attention, spikes and drops, latency, and both unified and classic connectors.
Source · techcommunity.microsoft.com
WizOct 22, 2026Added Oct 23
Wiz reported on Oct 22 that ARTEX, an open-source autonomous pentest framework (closed-source since Oct 8 after 12,000+ forks), was used throughout October against IT and software vendors: scraping JavaScript source maps and OpenAPI docs, unsigned JWT (alg: none) SSO bypass attempts, burst password spraying of Okta and Entra, and account-recovery abuse, rotating IPs and user agents when blocked. Wiz notes overlap with Microsoft's Storm-0940 report, which Microsoft links to a supply-chain attack using stolen vendor credentials against downstream Microsoft 365 tenants. Wiz shares IOCs, example log patterns, and detection rule names.
Source · wiz.io
DatadogOct 22, 2026Added Oct 23
Datadog announced on Oct 22 a Cost page in Agent Observability that ties estimated AI spend to applications, traces, models, providers, and tags, plus Cost Savings Opportunities (for example uncached prompt prefixes or full history re-sent each turn) with a Fix with Bits option. Agent Observability is free for up to 40,000 LLM spans a month.
Source · datadoghq.com
SplunkOct 22, 2026Added Oct 23
Splunk's Threat Research Team showed on Oct 22 five cooperating attack agents reaching Domain Admin, DCSync, and Linux root in 3 minutes 47 seconds in a lab; password spraying (T1110.003) was the top technique, and the defensive framework shown is a personal experimental project, not a Splunk product. Separately, SVD-2026-1013 (Oct 22) says no Splunk products are currently known to be affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619); Splunk OnCall and AppDynamics SaaS are under investigation.
Source · splunk.com
CrowdStrikeOct 23, 2026Added Oct 24
CrowdStrike Counter Adversary Operations (Oct 23) says most public PHP2Shell PoCs only crash PHP, reliable RCE must be tuned per PHP version, SAPI, app, and image, and it has seen only probing and failed attempts, with no successful exploitation in the wild or in honeypots. It recommends patching, rebuilding containers, restarting workers, disabling upload progress (which doesn't mitigate CVE-2026-109618), turning off file_uploads where unneeded, and limiting request bodies at the proxy or WAF.
Source · crowdstrike.com
CrowdStrikeOct 23, 2026Added Oct 24
CrowdStrike said on Oct 23 that Falcon Guardian, launched Sept 1, is deployed at hundreds of organizations, citing 260+ AI services discovered at one organization, a prompt-injection taxonomy of 200+ techniques, 99% detection at one financial services customer, and findings flowing into Next-Gen SIEM.
Source · crowdstrike.com
SentinelOneOct 21, 2026Added Oct 24
At OneCon (Oct 21), SentinelOne added partner certifications for Prompt Security, Endpoint and Identity, AI SIEM, AI Data Pipelines, and Purple AI with Hyperautomation, plus an AI Recon Assessment service, an ASOC Data Strategy Assessment, and partner early access to Singularity ADR. LevelBlue, GuidePoint, and WWT are launch partners.
Source · sentinelone.com
MicrosoftOct 23, 2026Added Oct 24
Microsoft (Oct 23) analyzed malicious LiteLLM 1.107.0, published Oct 21 on PyPI and official container images. It plants cook.pth, cook.py, and sitecustomize.py so starting Python runs a credential stealer even without importing LiteLLM, targeting AI-tool, cloud, Git, SSH, and browser credentials and LiteLLM proxy database data, exfiltrating to www.litellm[.]dev. Guidance: find every copy (environments, caches, mirrors, lock files, images), don't run python or pip in a suspect environment, rebuild from verified artifacts, rotate credentials from a clean machine, hash-pin dependencies, and restrict egress. Microsoft provides Defender detections and hunting queries.
Source · microsoft.com
WizOct 22, 2026Added Oct 24
Wiz (Oct 22) says Wiz Code normalizes, enriches (EPSS, CISA KEV), and deduplicates findings from its own and third-party scanners such as Snyk, Checkmarx, and Veracode, then uses the Wiz Security Graph to connect a code flaw to a running, internet-exposed workload as one attack path. Part 3 will cover remediation with the Wiz Green Agent.
Source · wiz.io
DatadogOct 23, 2026Added Oct 24
Datadog Agent 7.84.6 (Oct 23) makes its embedded Python reject TLS chains containing compromised eMudhra intermediate CA keys regardless of trust store, backporting the CPython fix for CVE-2026-115557; on Windows, Python checks no longer trust those chains via the Windows certificate store. Fix: upgrade Agents and Cluster Agents to 7.84.6; separately, upgrade pip to 26.2.2+ and certifi to 2026.10.19.
Source · github.com
SentinelOneOct 21, 2026Added Oct 25New
SentinelOne says its Singularity agent and AI SIEM content detect post-exploitation behavior after web-server flaws (shell commands, web shells, payload downloads, outbound connections) and Purple AI can hunt for it, while stating patching is the only complete fix. Guidance: patch and restart Apache and PHP-FPM, inventory bundled PHP, isolate PHP 8.1 and older, rotate secrets a PHP worker could hold.
Source · sentinelone.com
GoogleOct 25, 2026Added Oct 25New
Google SecOps added bulk case selection (up to 50 cases) in the enhanced Investigation Management case queue on Oct 22 and resizable inline images in Case Wall comments on Oct 25. New SecOps instances provisioned from Oct 26 won't support legacy API calls.
Source · docs.cloud.google.com